Commit 6cd6a9a1c2 for openssl.org
commit 6cd6a9a1c2faa67c4d3fbaf3aef5885b21413f6c
Author: Dr. David von Oheimb <dev@ddvo.net>
Date: Sat Apr 26 15:18:31 2025 +0200
doc/man1: fix description of -{,chain,verify}CAstore option parameters: filenames are allowed as well
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Simo Sorce <simo@redhat.com>
MergeDate: Thu Sep 10 13:32:51 2026
(Merged from https://github.com/openssl/openssl/pull/27507)
diff --git a/doc/man1/openssl-s_client.pod.in b/doc/man1/openssl-s_client.pod.in
index 57fc8aadf8..d4c45b71ee 100644
--- a/doc/man1/openssl-s_client.pod.in
+++ b/doc/man1/openssl-s_client.pod.in
@@ -29,10 +29,10 @@ B<openssl> B<s_client>
{- $OpenSSL::safe::opt_trust_synopsis -}
[B<-verifyCAfile> I<filename>]
[B<-verifyCApath> I<dir>]
-[B<-verifyCAstore> I<uri>]
+[B<-verifyCAstore> I<filename>|I<uri>]
[B<-chainCAfile> I<filename>]
[B<-chainCApath> I<directory>]
-[B<-chainCAstore> I<uri>]
+[B<-chainCAstore> I<filename>|I<uri>]
[B<-cert> I<filename>]
[B<-certform> B<DER>|B<PEM>|B<P12>]
[B<-cert_chain> I<filename>]
@@ -349,11 +349,11 @@ to trust for verifying the server's certificate.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
-=item B<-verifyCAstore> I<uri>
+=item B<-verifyCAstore> I<filename>|I<uri>
-URI of a store containing CA certificates
+The filename or URI of a store containing CA certificates
to trust for verifying the server's certificate.
-The URI may indicate a single certificate, as well as a collection of them.
+May indicate a single certificate, as well as a collection of them.
With URIs in the C<file:> scheme, this is generally treated like B<-verifyCApath> or
B<-verifyCAfile>, depending on if the URI indicates a directory or a single file.
See L<ossl_store(7)> for more information on stores and supported schemes.
@@ -379,11 +379,11 @@ when attempting to build the client certificate chain provided to the server.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
-=item B<-chainCAstore> I<uri>
+=item B<-chainCAstore> I<filename>|I<uri>
-The URI of a store containing trusted certificates to use
+The filename or URI of a store containing trusted certificates to use
when attempting to build the client certificate chain provided to the server.
-The URI may indicate a single certificate, as well as a collection of them.
+May indicate a single certificate, as well as a collection of them.
With URIs in the C<file:> scheme, this is generally treated like B<-chainCApath> or
B<-chainCAfile>, depending on whether the URI points to a directory or a single file.
See L<ossl_store(7)> for more information on stores and supported schemes.
diff --git a/doc/man1/openssl-s_server.pod.in b/doc/man1/openssl-s_server.pod.in
index 77b9882c12..8f5bcbfd0d 100644
--- a/doc/man1/openssl-s_server.pod.in
+++ b/doc/man1/openssl-s_server.pod.in
@@ -62,10 +62,10 @@ B<openssl> B<s_server>
[B<-crl_download>]
[B<-chainCAfile> I<infile>]
[B<-chainCApath> I<dir>]
-[B<-chainCAstore> I<uri>]
+[B<-chainCAstore> I<filename>|I<uri>]
[B<-verifyCAfile> I<infile>]
[B<-verifyCApath> I<dir>]
-[B<-verifyCAstore> I<uri>]
+[B<-verifyCAstore> I<filename>|I<uri>]
[B<-no_cache>]
[B<-ext_cache>]
[B<-verify_return_error>]
@@ -354,11 +354,11 @@ for verifying client certificates.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
-=item B<-verifyCAstore> I<uri>
+=item B<-verifyCAstore> I<filename>|I<uri>
-URI of a store containing trusted certificates to use
+The filename or URI of a store containing trusted certificates to use
for verifying client certificates.
-The URI may indicate a single certificate, as well as a collection of them.
+May indicate a single certificate, as well as a collection of them.
With URIs in the C<file:> scheme, this is generally treated like B<-verifyCApath> or
B<-verifyCAfile>, depending on whether the URI points to a directory or a single file.
See L<ossl_store(7)> for more information on stores and supported schemes.
@@ -383,11 +383,11 @@ for building the server certificate chain provided to the client.
This directory must be in "hash format",
see L<openssl-verify(1)> for more information.
-=item B<-chainCAstore> I<uri>
+=item B<-chainCAstore> I<filename>|I<uri>
-The URI of a store containing trusted certificates to use
+The filename or URI of a store containing trusted certificates to use
for building the server certificate chain provided to the client.
-The URI may indicate a single certificate, as well as a collection of them.
+May indicate a single certificate, as well as a collection of them.
With URIs in the C<file:> scheme, this is generally treated like B<-chainCApath> or
B<-chainCAfile>, depending on whether the URI points to a directory or a single file.
See L<ossl_store(7)> for more information on stores and supported schemes.
diff --git a/doc/man1/openssl-ts.pod.in b/doc/man1/openssl-ts.pod.in
index d7493f6bb2..86f1c5d523 100644
--- a/doc/man1/openssl-ts.pod.in
+++ b/doc/man1/openssl-ts.pod.in
@@ -55,7 +55,7 @@ B<-verify>
[B<-untrusted> I<files>|I<uris>]
[B<-CAfile> I<file>]
[B<-CApath> I<dir>]
-[B<-CAstore> I<uri>]
+[B<-CAstore> I<filename>|I<uri>]
{- $OpenSSL::safe::opt_v_synopsis -}
{- $OpenSSL::safe::opt_provider_synopsis -}
@@ -347,7 +347,7 @@ certificates as far as the response already includes them.
Multiple sources may be given, separated by commas and/or whitespace.
Each file may contain multiple certificates.
-=item B<-CAfile> I<file>, B<-CApath> I<dir>, B<-CAstore> I<uri>
+=item B<-CAfile> I<file>, B<-CApath> I<dir>, B<-CAstore> I<filename>|I<uri>
See L<openssl-verification-options(1)/Trusted Certificate Options> for details.
At least one of B<-CAfile>, B<-CApath> or B<-CAstore> must be specified.
diff --git a/doc/man1/openssl-verification-options.pod b/doc/man1/openssl-verification-options.pod
index e330f8f015..09d6de75b7 100644
--- a/doc/man1/openssl-verification-options.pod
+++ b/doc/man1/openssl-verification-options.pod
@@ -302,10 +302,10 @@ See L<openssl-rehash(1)> for information on creating this type of directory.
Do not use the default directory of trusted certificates.
-=item B<-CAstore> I<uri>
+=item B<-CAstore> I<filename>|I<uri>
-Use I<uri> as a store of trusted certificates.
-The URI may indicate a single certificate or a collection of them.
+Use I<filename> or I<uri> as a store of trusted certificates.
+May indicate a single certificate or a collection of them.
When the URI references a file, only the PEM format is supported.
With URIs in the C<file:> scheme, this is generally treated like B<-CApath> or
B<-CAfile>, depending on whether the URI indicates a directory or a single file.